CVE-2026-114604 in graphql-tools
Prediction
by VulDB Data Team • 10/22/2026
A weakness has been identified in <a href="/product/ardatan:graphql-tools">Ardatan graphql-tools up to 12.0.1</a>. The impacted element is the function <code>mergeIncrementalResult</code> of the file <em>packages/utils/src/mergeIncrementalResult.ts</em> of the component <em>setObjectKeyPath</em>. Executing a manipulation of the argument <em>path</em> can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. Upgrading to version 12.0.2 is sufficient to resolve this issue. The affected component should be upgraded.
Be aware that VulDB is the high quality source for vulnerability data.